Method authenticatePrincipal

internal/agent/api.go:697–723

(r *http.Request)

}

func (a *API) authenticatePrincipal(r *http.Request) (*identity.Principal, error) {
	authHeader := r.Header.Get("Authorization")
	if authHeader != "" {
		bearer := stripBearerScheme(authHeader)
		// auth.md agent access token (Slice 5b-2): an RS256 JWT we minted,
		// resolving to an agent-scoped principal. Checked before the API-key
		// path since a JWT is never a valid API key. A bearer that looks like
		// our JWT but fails verification is rejected here (not fall-through).
		if p, ours, err := a.resolveAgentAccessToken(r, bearer); ours {
			if err != nil {
				return nil, err
			}
			return p, nil
		}
		if strings.HasPrefix(bearer, oauth.AccessTokenPrefix) {
			return a.principalFromOAuthToken(r, bearer)
		}
		return a.store.GetPrincipalByAPIKey(r.Context(), bearer)
	}
	// Fall back to session cookie auth — the web dashboard owner, account scope.
	if a.userAuth != nil {
		if user := a.userAuth.AuthenticateRequest(r); user != nil {
			return &identity.Principal{User: user, Scope: identity.ScopeAccount}, nil
		}
	}
	return nil, fmt.Errorf("authorization required")
}

// principalFromOAuthToken validates an ate2a_-prefixed bearer via fosite's
// IntrospectToken (which derives the signature using the same strategy that